fs_usage

Filesystem usage (process/pathname)
Requires root privileges due to the kernel tracing facility it uses to operate.

Syntax
fs_usage [-e] [-w] [-f mode] [pid|cmd [pid|cmd] ...]
Options
-e Generate output that excludes the running fs_usage tool.
If a list of process ids or commands is also given, then
those are also excluded.
-w Force a wider, more detailed output, regardless of the window size.
-f Turn on output filtering based on the mode provided.
By default no filtering occurs. The supported
modes are: network Only network related output is displayed.
filesys Only file system related output is displayed.

By default
the activity monitored includes all system processes except the running
fs_usage process, Terminal, telnetd, sshd, rlogind, tcsh, csh and sh.
These defaults can be overridden such that output is limited to include
or exclude a list of processes specified by the user.

Output columns:

CALL The name of the network or filesystem related call, page-in,
page-out or physical disk access.

FILE DESCRIPTOR
Of the form F=x, x is a file descriptor. Depending on the type
of system call, this will be either an input value or a return
value.

BYTE COUNT
Of the form B=x, x is the number of bytes requested by the call.

[ERRNO]
On error, the errno is displayed in brackets.

PATHNAME
Pathname of the file accessed (up to the last 28 bytes).

FAULT ADDRESS
Of the form A=0xnnnnnnnn, where 0xnnnnnnnn is the address being
faulted.

DISK BLOCK NUMBER
Of the form D=0xnnnnnnnn, where 0xnnnnnnnn is the block number of
the physical disk block being read or written.

OFFSET Of the form O=0xnnnnnnnn, where 0xnnnnnnnn is a file offset.

SELECT RETURN
Of the form S=x, x is the number of ready descriptors returned by
the select() system call. If S=0, the time limit expired.

TIME INTERVAL(W)
The elapsed time spent in the system call. A `W' after the
elapsed time indicates the process was scheduled out during this
file activity. In this case, the elapsed time includes the wait
time.